Breakthroughs in AI have helped fuel an 80 per cent surge in attacks on the nation’s businesses and government agencies by criminals and countries such as China and Russia, with warnings the new technology could be used to wipe out the superannuation savings of ordinary Australians.
In its annual assessment of cyber threats, to be released on Tuesday, the Australian Signals Directorate said the nature and speed of attacks had changed sharply since the emergence of so-called “frontier” AI this year, jeopardising businesses and the overall economy.
Frontier AI models, such as the latest and most advanced versions of artificial intelligence such as Anthropic’s Mythos, deliver complex problem-solving and advanced scientific modelling but has also been used to identify vulnerabilities in computer software.
The technology uncovered vulnerabilities in the computer programming language PHP that forced numerous websites offline last week for patching, including the Australian Bureau of Statistics.
But ASD director-general Abigail Bradshaw said while AI enabled agencies such as hers to identify and take swift action against cyberattacks, it was also used by criminals and bad actors to mount more dangerous digital assaults.
“They [frontier AI] are creating enormous opportunities, but they are also enabling malicious cyber actors to identify vulnerabilities and conduct attacks faster, at a greater scale and with the greater precision than ever before. This shift will only accelerate,” she said.
“As the global security environment remains challenging, state-sponsored cyber actors will increasingly leverage AI to enhance the scale, speed and effectiveness of their operations.”
David Bradbury, deputy chairman of the Australian Prudential Regulation Authority, told The Australian Financial Review’s Super and Wealth Summit on Monday that the risk posed by cyberattacks kept him awake at night.
“It’s important and central that we’re ensuring that members’ best interests are being observed, but when you’re talking about things like a cyberattack that might be amplified by AI, driven by foreign actors; something like this could actually start to clean out people’s accounts,” he said.
Australian superannuation funds hold more than $4.5 trillion in assets spread across at least 25 million accounts.
In the 2025-26 financial year, the ASD notified companies and agencies more than 4400 times of potentially malicious cyber activity in a bid to prevent an attack – an 80 per cent jump on the previous year.
The agency responded to more than 1500 incidents in 2025-26 – up from the 1200 in 2024-25.
It received more than 82,000 cybercrime reports or one every six minutes, blocked customer access to more than 564 million malicious website domains and responded to 139 ransomware incidents.
The cost to businesses from cyberattacks continues to grow, climbing 16 per cent last year to an average $93,500 for self-reported cases. Attacks on medium-sized businesses jumped by 45 per cent to an average cost of $141,300.
A continuing issue is the wide scale use of “legacy” software and hardware by businesses and government agencies which is too old to be updated to deal with increasingly sophisticated attacks.
In a sign of the directorate’s concerns that many businesses are moving too slowly, Bradshaw urged firms and agencies to quickly update their cyber protections, even if it meant shutting down an online presence temporarily to safeguard their operations.
“Organisations must take action to improve basic cyber hygiene. System security must be prioritised over system availability in order to deal with increased vulnerability discovery by AI models,” she said.
“The less legacy technology exposed to the internet, the fewer opportunities malicious actors have to gain access.”
Australia is a member of the “five eyes” group of intelligence-sharing nations that includes the United States, Britain, Canada and New Zealand. That has enabled Australia to keep using Mythos, an AI agent deemed so powerful the Trump administration has clamped down on access.
A key concern remains state-sponsored actors, largely from China and Russia, trying to gain access to sensitive or private information. In some cases, they seek to learn how a business or agency works or gather information that fills their own intelligence gaps.
In August last year, the ASD released an advisory warning on the amount of global cyber espionage linked to Chinese state-sponsored entities that it described as a network designed to “collect sensitive information at scale”.
The ASD also maintains contact with major AI developers to keep on top of technology and risk developments. Some of this top secret information is shaping the warnings delivered by the ASD about the growing risks posed by cyberattacks.
Defence Minister Richard Marles said in a statement that the risk of cyber incidents had increased substantially, backing the ASD’s call for businesses to prioritise security over service provision.
“AI is reshaping the online landscape, enabling cybercriminals and state-sponsored actors to launch faster, more sophisticated and scaleable attacks. To stay ahead, Australians must enhance their cyber defences while harnessing AI’s benefits,” he said.
The nation’s banks are considered the most aware of the threat posed by AI-connected attacks. But the entire financial system is a prize target.
Cut through the noise of federal politics with news, views and expert analysis. Subscribers can sign up to our weekly Inside Politics newsletter.